Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following string produced by a server log file. I am using Simple Event Correlator (which uses perl regex) to manipulate lines:

18:37:31 643.65.123.123 []sent /home/mydomain/public_html/court-954fdw/Chairman-confidential-video.mpeg 226 256

and I have been successful in using perl regex to successfully extract the user who logs in with the following pattern.

NOTE: the values that SEC uses are extracted from the data contained in the parenthesis:

pattern=sent \/home\/mydomain\/public_html\/(.*)\/(.*)

However, I have been unsuccessful in parsing out just the file name which in this case would be: Chairman-confidential-video.mpeg.

Currently the existing pattern I use pulls out the entire string:

Chairman-confidential-video.mpeg 226 256

which I don't want. Any help much appreciated.

share|improve this question

I would probably use:

pattern=sent \/home\/mydomain\/public_html\/(.*)\/(\S+).*

This should extract out all but whitespace characters for the last capturing match, and leave the rest for the non-capturing match.

share|improve this answer

I'd use the following:

pattern=sent \/home\/mydomain\/public_html\/(.*?)\/\(.* ?)\S*.*$

For more explicit non-greedy matching. Your result will now be in $2. This assumes that you can't hard-code anything below public_html. This does leave a trailing space.

share|improve this answer
Regex is invalid due to erroneous escaping of 3rd parenthesis. Not able to edit it. – matthiash Jul 6 at 19:23

Other answers assumes no whitespace in filename, a rather risky assumption. A safer bet is to assume no slashes in filename, as that is illegal in linux:

pattern=sent \/home\/mydomain\/public_html\/([^\/]+)\/([^\/]+) [0-9]+ \S+@\S+ [0-9]+$

Tested at

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.